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Period for Reply 
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THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
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earned patent term adjustment. See 37 CFR 1.704(b). 
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2a)n This action is FINAL. 2b)^ This action is non-final. 
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4) ^ Claim(s) 1-22 is/are pending in the application. 
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5) n Claim(s) is/are allowed. 
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Application Papers 
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DETAILED ACTION 

Claims 1-22 have been examined and are pending. 

Information Disclosure Statement 

The IDS submitted by the applicant have been considered. 

Election/Restrictions 
Restriction to one of the following inventions is required under 35 U.S.C. 121: 

I. Claims 2-5 and 8, drawn to use of a database on a network server to 
determine keyboard sequences, classified in class 707, subclass 10. 

II. Claims 9-10, drawn to graphical representation of a computer keyboard, 
classified in class 710, subclass 15. 

III. Claims 1 , 6-7, 1 1-22, drawn to determining triviality of proposed user's 
passwords, classified in class 713, subclass 183. 

The inventions are distinct, each from the other because of the following reasons: 
Inventions I, II, and III are related as subcombinations disclosed as usable 
together in a single combination. The subcombinations are distinct from each other if 
they are shown to be separately usable. In the instant case, invention I has separate 
utility such as visually monitoring a user's interaction with a keyboard. Invention II has 
separate utility such as a keyboard simulation system. Invention III has separate utility 
such as determining if a user's proposed password is trivial. See MPEP § 806.05(d). 

Because these inventions are distinct for the reasons given above and the 
search required for Group I is not required for Groups II and III, the search for Group II 
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is not required for Groups I and III, and the search for Group III is not required for 
Groups I and II, restriction for examination purposes as indicated is proper. 

During a telephone conversation with Mr. William Kennaman (845-433-1 175) on 
6/27/2005 a provisional election was made with traverse to prosecute the invention of 
Group III, claim 1, 6-7, and 1 1-22. Affirmation of this election must be made by 
applicant in replying to this Office action. Claim 2-5 and 8-10 are withdrawn from further 
consideration by the examiner, 37 CFR 1.142(b). as being drawn to a non-elected 
invention. 

Specification 

The disclosure is objected to because of the following informalities: 
1 . On page 9, paragraph 30, the examiner believes there may be errors on line 4. 
Applicant is asked to double check. Note the value for F3 given in line 4 is not the 
same as the value given in line 5. The formula on line 4 also doesn't seem to agree 
with the formula on line 3, even though applicant used "or" to indicate that they 
should be equivalent. 

Appropriate correction is required. 

Claim Rejections - 35 USC § 112 
The following Is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 11-22 are rejected under 35 U.S.C. 112, second paragraph, as failing to 

set forth the subject matter which applicant(s) regard as their invention. 
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1 . As per claim 1 1 , the formula recited in line 12 is unclear. The examiner is 
uncertain if applicant meant AXn-1 (i.e. AXn and then subtract 1) or AX with a 
subscript of (n-1). 

2. Claim 17 recites a similar formula which is unclear on line 14. 

3. A similar problem exists for the formula recited in claims 12 and 18, line 3 for AY. 

4. Similar problems exist for the formulas recited in claims 13 and 19, lines 2 and 3 
respectively. 

5. Any claims not specifically addressed are rejected by virtue of dependency. 
Appropriate correction is required. 

Claim Rejections - 35 USC § 103 

Claims 1, 6-8, and 11-22 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Swift et al (US 5,719,941) in view of IBM Technical Disclosure 
Bulletin ("Passphrase Filter for Detection/Rejection of Weak User-Selected 
Passphrases), herein referred to as IBM. 
Claim 1: 

Swift discloses a network system for determining trivial keyboard sequences of 
proposed passwords, comprising: 

1 . A user system (Fig 1 , items 20-26). 

2. A server in communication with said user systems via a communication link (Fig 
1). 
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3. A data storage device coupled to said server (Fig 1), said data storage device 
housing: 

a. A master password database including a user account associated with 
said user system (Fig 1, item 34). 

b. A password verification mechanism executable by said server (col 9, lines 
35-50). 

c. Wherein, upon execution, said password verification mechanism performs 
an algorithm on said proposed password and determines triviality of said 
proposed password according to criteria specified in said algorithm (col 9, 
lines 35-50). 

Swift does not explicitly disclose a computer keyboard input device associated 
with said user system. However/ such a keyboard input device must exist for a user to 
be able to input a password into Swift's system. 

Swift also does not disclose a database including a keyboard profile wherein said 
keyboard profile specifies a physical layout of characters and function keys on said 
keyboard input device. However, such a limitation is disclosed by IBM (p97 and p98, 
first two paragraphs). In light of this, it would have been obvious to one of ordinary skill 
in the art at the time the applicant's invention was made to have modified Swift's 
invention according to the limitations recited in claim 1 using IBM's teachings. One of 
ordinary skill would have been motivated to do so as IBM's teachings describes a 
method for detection/rejection of weak user selected passphrases (p95, paragraph 1). 
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Claim 6: 

Swift does not disclose wherein said algorithm comprises three formulas 
wherein: 

1 . A first formula checks for vertical triviality of said proposed password. 

2. A second formula checks for horizontal triviality of said proposed password. 

3. A third formula checks for diverse keystroke patterns of said proposed password 
wherein said second formula is executed upon successful validation of said first 
formula and said third formula is executed upon successful validation of said 
second formula. 

However, the above limitations are obvious to the combination invention of Swift 
and IBM. IBM discloses a pattern and letter frequency analysis method which reads on 
the above limitations (p97 and p98). In the pattern analysis method disclosed by IBM, 
each key on the keyboard is numbered. Then, a proposed password is analyzed using 
formula which checks the first order difference— the horizontal triviality of the proposed 
password or passphrase. Then, a formula to check the second order difference is 
used — checking the vertical triviality. The letter frequency analysis disclosed on page 
98 reads on the diverse keystroke pattern analysis of the password. It is further obvious 
that each proceeding algorithm would be executed upon successful validation of each 
preceding algorithm as the way most conditional statements are written in software 
development practices is that the latter checks aren't executed if the earlier checks 
results in false statements. One of ordinary skill would be motivated to do this because 
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it is common practice in software development. The motivation to combine Swift and 
IBM according to the limitations recited in claim 6 is the same as the ones given in claim 
1 . Note that the order in which the three formulas are executed is an arbitrary choice 
which does not affect the functionality of the applicant's or Swift and IBM's combination 
invention. 
Claim 7: 

Swift further discloses wherein successful validation of the proposed password 
causes the password verification mechanism to transmit notification to at least one of a 
requesting user system and an administrator system and update said master password 
database (col 9, lines 50-63). 
Claim 8: 

Swift does not explicitly disclose wherein said server and said data storage 
device comprise one unit. However, servers and data storage devices being comprised 
of one unit are well known in the art — i.e. a server computer with a hard drive. Further, 
in Figure 1, First Network Server 12 is shown to contain Password Administration 
Facility 32 and Tables 34 and 36. This implies that server 12 must contain a data 
storage device comprising one unit with server 12 or server 12 could not contain these 
items as there must be a storage device within server 12 to hold information for items 
32, 34, and 36 somehow. 
Claims 11 and 17: 
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Swift discloses a method as recited in claim 1 1 and a storage medium encoded 
with machine-readable computer program code as recited in claim 17 for determining 
keyboard triviality of proposed passwords over a network system, comprising: 

1. Receiving a request for a proposed password from a user system (Fig 2 and 3). 

2. Retrieving user account data related to said user system (Fig 2 and 3). 

3. Checking said proposed password against existing password quality rules stored 
in a master password database (col 9, lines 35-50), wherein a requester of said 
proposed password is redirected to select an alternative password if said 
checking results in an unacceptable password (col 9, lines 42-50). 



Swift does not explicitly disclose: 

1. Providing a keyboard profile associated with said user system, said keyboard 
profile including a unique identifier. 

2. Performing an algorithm on said proposed password, said algorithm including a 
first formula, comprising: 

(AX1 + AX2 + ... + AXn - 1) / (n - 1) > 0; 
wherein: 

1 . X represents an X axis. 

2. Y represents a Y axis. 

3. n represents a number of characters comprising said proposed password. 

4. AX1 represents an absolute value of a difference between a first and 
second data coordinate on said X axis. 
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5. And wherein further data coordinates are plugged into said first formula for 
determining vertical triviality. 

However, IBM discloses a pattern analysis method for detection of a weak user- 
selected passph rase/password which renders the above limitation obvious (p97 and 
p98, first two paragraphs). In the pattern analysis method disclosed by IBM, each 
number and letter key on the keyboard is assigned a rank number from 1-36. This 
reads on the limitation of a keyboard profile. Note that different types of keyboards are 
known, so different keyboard profiles with unique identifiers are also obvious. IBM also 
discloses that the rank number analysis can be used on a 'qwerty' keyboard, meaning 
IBM also recognizes different keyboard profiles (p98, second paragraph). Further, in 
the pattern analysis method disclosed by IBM, the difference in rank (first order 
difference) of each character in the proposed password is determined (p97, item 4). 
This analysis of the first order difference reads on the above first formula (which is used 
to determine horizontal triviality). 

In light of the above, it would have been obvious to one of ordinary skill in the art 
at the time the applicant's invention was made to have modified Swift's invention 
according to the limitations recited in claims 1 1 and 17. One of ordinary skill would 
have been motivated to do so for the same reasons given in claim 1 . 
Claims 12 and 18: 

Swift does not explicitly disclose wherein said algorithm includes a second 
formula executable upon successful completion of first formula, comprising: 
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(AY1 + AY2 + ... + AYn - 1) / (n - 1) > 0; 
wherein: 

1 . X represents an X axis. 

2. Y represents a Y axis. 

3. h represents a number of characters comprising said proposed password. 

4. AY1 represents an absolute value of a difference between a first and second 
data coordinate on said Y axis. 

5. And wherein further data coordinates are plugged into said second formula 
for determining vertical triviality. 

However, the above limitation is obvious to the combination invention of Swift 
and IBM. Note that on page 97, item 4, IBM also discloses a second order difference 
analysis. This reads on the above formula wherein a test of vertical triviality is made. 
Motivation to combine Swift and IBM are the same as the ones given in claim 1 . 
Claims 13 and 19: 

Swift does not explicitly disclose wherein said algorithm includes a third formula, 
comprising: 

(AX1 + AY1 + AX2 + AY2 + ... + AXn «1 + AYn - 1) / (2(n - 1)) > S; 
wherein: 

1 . X represents an X axis. 

2. Y represents a Y axis. 

3. n represents a number of characters comprising said proposed password. 
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4. AX1 represents an absolute value of a difference between a first and second 
data coordinate on said X axis. 

5. AY1 represents an absolute value of a difference between a first and second 
data coordinate on said Y axis. 

6. S represents a variable parameter representing a mean distance between 
character keys of proposed passwords. 

7. And wherein further data coordinates are plugged into said third formula for 
determining diverse keystroke patterns of said proposed password. 

However, the examiner submits that the above limitation is obvious to the 
combination invention of Swift and IBM. Note that the formula on the left side of the 
equation of the above limitation is the summation of the first two formulas used to 
determine both the horizontal and vertical triviality. As discussed already, the teachings 
of IBM renders these two formulas obvious. It is further obvious that viewed together, 
the first two formulas can also be used to determine how diverse the characters in the 
proposed password are as the characters must both pass horizontal and vertical 
triviality tests to be diverse. How diverse the characters must be is an arbitrary choice 
determined by parameter S; it is obvious to have such a parameter be defined in the 
combination invention of Swift and IBM. Further, IBM also discloses on page 98 that a 
letter frequency analysis is performed on proposed passwords, which also reads on the 
diverse keystroke analysis of the above limitation. Motivation to combine Swift and IBM 
are the same as the ones given in claim 1. 
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Claims 14 and 20: 

Claims 14 and 20 recite limitations substantially similar to claim 7 and are 
rejected for the same reasons. 
Claims 15 and 21: 

Swift does not explicitly disclose wherein said identifier is linked to said user 
account, and wherein further, said keyboard profile is automatically provided over said 
network via said link. However, these limitations are obvious to the combination of Swift 
and IBM. Note that IBM discloses that more than one keyboard profiles are known 
(p98, second paragraph). Further, as the analysis of the password in the combination 
invention of Swift and IBM depends on the keyboard profile, the keyboard profile of the 
user must be known by the password analysis algorithm. Each profile must have a 
unique identifier and each user account must be associated with a profile. Swift shows 
that the user account information is kept on a server (Fig 1), therefore when a user 
communicates via a client, the keyboard profile of the client must be sent over a 
network link to the server so that the proposed password analysis can be performed. 
Claims 16 and 22: 

Swift does not explicitly disclose wherein a list of available keyboard profiles is 
present to said user selection, and wherein further, said user system selects an 
appropriate profile. However, multiple keyboard profiles available for user selection are 
well known in the art (i.e. multiple language keyboards). It is obvious that since multiple 
profiles exist, a user can select the different profiles on a user system according to the 
user's preference as to what type of keyboard they prefer to type on. In light of this, it 
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would have been obvious to one of ordinary skill in the art to have modified Swift and 
IBM's combination invention according to the limitations recited in claims 16 and 22. 
One of ordinary skill would have been motivated to do so as it would allow users to 
select the keyboard profile most suited to their typing preferences. 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Ponnoreay Rich whose telephone number is 571-272- 
7962. The examiner can normally be reached on 8:00am-4:30pm Mon-Fri. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on 571-272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (RAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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